Fix agent investigations to rely on log evidence for VPN route errors

[eirenik0]

Summary

• Persist recent log evidence in agent investigation context and output
• Show log evidence in proxy2vpn agent investigate so operators can act on the actual logs
• Classify OpenVPN route setup warnings as route_error instead of mislabeling them as auth/config failures
• Update investigation guidance and action plans to prioritize route-state review when route errors are present
• Add regression coverage and a Towncrier bugfix fragment

Testing

• make fmt
• make lint
• uv run pytest tests/test_diagnostics.py tests/test_agent_runtime.py tests/test_agent_cli.py tests/test_agent_llm.py